The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The rendering script includes logic to dynamically download and install the beautiful-mermaid package from a remote registry if it is not present in the environment.
Evidence: The ensurePackage function in scripts/render.ts executes installation commands via child_process.execSync.
[COMMAND_EXECUTION]: The skill executes shell commands to manage dependencies and environment setup.
Evidence: scripts/render.ts calls execSync to run npm install or bun add depending on the detected runtime.
[DYNAMIC_EXECUTION]: The rendering script utilizes runtime loading for its primary dependency.
Evidence: scripts/render.ts uses dynamic import() to load the beautiful-mermaid library after installation.
[EXTERNAL_DOWNLOADS]: The skill initiates network requests to the NPM registry to fetch executable code at runtime.
Evidence: Automatic package installation initiated by scripts/render.ts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted diagram code and processes it with scripts that have file-writing and browser-control capabilities.
Ingestion points: scripts/render.ts accepts user-supplied strings via the --code flag.
Boundary markers: No delimiters or explicit safety instructions are used when handling user-provided Mermaid code.
Capability inventory: The skill can write SVG and HTML files to the local system and execute capture commands via agent-browser.
Sanitization: There is no evidence of Mermaid code validation or sanitization before it is passed to the rendering engine.

beautiful-mermaid